How with dhdp monitor service deactivated, did Call Manager still assign an ip address to a laptop that plugged into the vlan

[maryclegg]

  We are having a problem with IP addresses being assigned by the call manager even though the DHCP Monitor service is deactivated. We found it by accident when a tech here who inadvertently plugged into the voice vlan that has the voice mail server, phone server, analog gateway, 2821 voice gateway and phones and he was assigned an IP address and it indicated that it was our publisher call manager that issued the IP address. We also were able to take the cable from a phone and plug into a laptop and receive an ip address from CM. Auto registration is disabled - which I don't believe is relevant to this problem, but is relevant to  a second problem we had.

We have a Tac S/R on this problem but they are stumped and going to do more research and call us back.

This is a huge security risk for us. We do not want anybody to be able to take a phone cable and plug into a laptop and get an ip address. Do you have any ideas on why an IP address was assigned with DHCP disabled????? AND HOW TO FIX IT???  Thanks!

[Chris Deren]

How did you figure it was CUCM that assigned the IP address?

Chris

[maryclegg]

Hi Chris, I don't think I followed the proper procedure to answer your question.  

An ipconfig/all command showed that the CUCM assigned the ip address.

[maryclegg]

TAC support finally found this:

After doing a research. We discovered you are hitting Bug CSCso60222. This was first found under Call Manager version 6 and currently there is no permanent solution.

The only workaround available is to do what you have been doing, reboot the Server.

You can find more details about this Bug here:

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCso60222

[Rob Huffman]

Hi Mary,

Hope all is well with you

Thanks for posting up your results here. +5

I find it interesting that this is a level 6 - Enhancement

Cheers!

Rob

"May your heart always be joyful
May your song always be sung" - Bob Dylan

[maryclegg]

Hi Rob,

It was great to hear from you.  Hope all is well with you.  Just FYI:

In summary, here is what we experience:

-We keep the DHCP service on the Call Managers shut down and deactivated (so that it will not restart automatically). This is our normal state.

-Just after a Call Manager startup or reboot, the server behaves correctly and does not assign DHCP address to clients.

-On certain occasions, we turn on DHCP to get an address assigned on a phone (no other clients other than Cisco phones are on this network, and we do not piggyback the PC connections). Immediately afterwards, we deactivate DHCP and shut down the service.

-With the service shut down at the Call Manager level, the publisher Call Manager continues to give out DHCP addresses to client requests until it is shut down or rebooted.

-Since noticing the problem about a month ago, we have tested this scenario at least 4 times and found the same results in each scenario.

-It looks like once the DHCP service started, it does not end correctly until the server is taken down.